Users July 2019

users@lists.roundcube.net

8 participants
20 discussions

Strange sieve script
by Jorge Bastos 24 Nov '19

24 Nov '19

Howdy, I've seen some some time and in distinct users, a redirect script been added to an email that has nothing to do with them. Maybe it's for fishing or other intention, maybe even espionage, which is real nowadays. Did anyone saw this in your users? I catched this in a regular "mailq" investigation for problems

2 2

Content Security Policy for Roundcube
by James Brown 11 Oct '19

11 Oct '19

Turning on 'Show Javascript Console' from Safari Develop menu showed me that my Content Security Policy was preventing emails displaying in mailboxes. Additionally at logout I get the message "PHP Error: Request security check failed REQUEST CHECK FAILED For your protection, access to this resource is secured against CSRF. If you see this, you probably didn't log out before leaving the web application. Human interaction is now required to continue." Please contact your server-administrator. Commenting out the CSP line in https.conf fixed it. Currently using: Header set Content-Security-Policy "default-src 'self'; form-action 'self'; frame-ancestors 'self'; base-uri ‘self' Which fails. Is there a recommended CSP for Roundcube? thanks, James.

5 9

Roundcube, This content can not be displayed in a frame error
by David Mehler 12 Aug '19

12 Aug '19

Hello, Up until about half an hour ago I had a working roundcube installation running on php 7.3 and apache 2.4. I went in to tweak my X-Frame-Options headers among others in apache and now I'm getting the error this content can not be displayed in a frame. This is with ie11. Chrome isn't showing me messages either, but it isn't giving the error. Now I did have the webmail open in an ie tab during this working, but it was not logged in in fact I ignored it. I've sense put the option back to SAMEORIGIN, restarted both apache and php-fpm several times, refreshed the ie browser window, deleted temporary internet files, still getting the error. I've even gone in to defaults.inc.php (yes I know that's not standard practice) and changed x_frame_options from it's default of sameorigin to false, again restarted both apache and php-fpm as well as another ie refresh, still getting the error. I have not checked on another computer i'm not near one at the moment. Any ideas very welcome. Thanks. Dave.

2 1

managesieve-plugin closes connection before negotiation
by Florian Ruhnke (OiledAmoeba) 09 Aug '19

09 Aug '19

Hi, I do have an running dovecot-sieve installation. There is no problem to use it with rainloop or Thunderbird. But I can't get roundcube to work with sieve. Dovecot forces to initiate TLS before auth. SSL is disabled, only TLS 1.2+ is enabled. sieve-log of roundcube: [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "IMPLEMENTATION" "Dovecot Pigeonhole" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "NOTIFY" "mailto" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "SASL" "" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "STARTTLS" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: "VERSION" "1.0" [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: OK "Doctor, your Tardis is ready." [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> C: STARTTLS [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: NO "Error in MANAGESIEVE command received by server." [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> C: LOGOUT [31-Jul-2019 16:24:29 +0200]: <fqn6h82s> S: OK "Begin TLS negotiation now." maillog (dovecot errors): Jul 31 16:24:29 mail dovecot: managesieve-login: Disconnected (no auth attempts in 0 secs): user=<>, rip=10.23.102.80, lip=10.23.102.251, TLS handshaking: SSL_accept() failed: error:1408F10B:SSL routines:ssl3_get_record:wrong version number, session=<rbUW4vqOC+MKF2ZQ> managesieve config.inc.php: $config['managesieve_port'] = 4190; $config['managesieve_host'] = 'mail.domain.tld'; $config['managesieve_auth_type'] = 'PLAIN'; $config['managesieve_auth_cid'] = null; $config['managesieve_auth_pw'] = null; $config['managesieve_usetls'] = true; //$config['managesieve_conn_options'] = null; $config['managesieve_conn_options'] = array( 'ssl' => array( 'verify_peer' => true, 'verify_peer_name' => true, 'allow_self_signed' => false, ), ); $config['managesieve_default'] = '/etc/dovecot/sieve/global'; $config['managesieve_script_name'] = 'managesieve'; $config['managesieve_mbox_encoding'] = 'UTF-8'; $config['managesieve_replace_delimiter'] = ''; $config['managesieve_disabled_extensions'] = array(); $config['managesieve_debug'] = true; $config['managesieve_kolab_master'] = false; $config['managesieve_filename_extension'] = '.sieve'; $config['managesieve_filename_exceptions'] = array(); $config['managesieve_domains'] = array(); $config['managesieve_vacation'] = 1; $config['managesieve_vacation_interval'] = 0; $config['managesieve_vacation_addresses_init'] = false; $config['managesieve_vacation_from_init'] = false; $config['managesieve_notify_methods'] = array('mailto'); $config['managesieve_raw_editor'] = true; The dovecot-log looks like roundcube is trying to initiate SSL3 but this is disabled. I think "Error in MANAGESIEVE command received by server." has to do with the deactivated SSL. Connecting to dovecot manually with gnutls-cli --starttls -p 4190 mail.domain.tld: Processed 306 CA certificate(s). Resolving 'mail.domain.tld:4190'... Connecting to '<IP>:4190'... - Simple Client Mode: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate m ime foreverypart extracttext imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "" "STARTTLS" "VERSION" "1.0" OK "Doctor, your Tardis is ready." NO "Error in MANAGESIEVE command received by server." STARTTLS OK "Begin TLS negotiation now." *** Starting TLS handshake - Certificate type: X.509 - Got a certificate list of 2 certificates. - Certificate[0] info: - subject `CN=mail.domain.tld', issuer `CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US', serial 0x03c0d3d322307e5a997f654b435b56480773, RSA key 4096 bits, signed using RSA-SHA256, activated `2019-06-06 09:18:10 UTC', expires `2019-09-04 09:18:10 UTC', pin-sha256="8Sl17lWxWYSJcTcppQG4DLSBhEP/uRkZ5NTQfdkkoS4=" Public Key ID: sha1:62b08cf75ae6c45915db8d8c7bff6947788ac3b2 sha256:f12975ee55b1598489713729a501b80cb4818443ffb91919e4d4d07dd924a12e Public Key PIN: pin-sha256:8Sl17lWxWYSJcTcppQG4DLSBhEP/uRkZ5NTQfdkkoS4= - Certificate[1] info: - subject `CN=Let's Encrypt Authority X3,O=Let's Encrypt,C=US', issuer `CN=DST Root CA X3,O=Digital Signature Trust Co.', serial 0x0a0141420000015385736a0b85eca708, RSA key 2048 bits, signed using RSA-SHA256, activated `2016-03-17 16:40:46 UTC', expires `2021-03-17 16:40:46 UTC', pin-sha256="YLh1dUR9y6Kja30RrAn7JKnbQG/uEtLMkBgFF2Fuihg=" - Status: The certificate is trusted. - Description: (TLS1.3)-(ECDHE-SECP256R1)-(RSA-PSS-RSAE-SHA256)-(AES-256-GCM) - Options: "IMPLEMENTATION" "Dovecot Pigeonhole" "SIEVE" "fileinto reject envelope encoded-character vacation subaddress comparator-i;ascii-numeric relational regex imap4flags copy include variables body enotify environment mailbox date index ihave duplicate mime foreverypart extracttext imapsieve vnd.dovecot.imapsieve" "NOTIFY" "mailto" "SASL" "PLAIN LOGIN" "VERSION" "1.0" OK "TLS negotiation successful." LOGOUT OK "Logout completed." - Peer has closed the GnuTLS connection So, what do I have to do to get roundcube to talk to sieve?

2 2

Lost Contacts Entries
by Mark Constable 04 Aug '19

04 Aug '19

Hi, I'm using 1.3.9 and recently switched my backend mailserver from an old server to a new server BUT the $config['default_host'] = 'ssl://mymail.server' setting remained exactly the same, only the IP for mymail.server was changed. I'd been caught out a few years ago when I changed default_host to a different IP and learnt the hard way and that doubled up with new user entries with the new IP and I think I sorted that out. This time the default_host setting is exactly the same. I did find a post that mentioned to run the bin/indexcontacts.sh script, which I did, and now the Contact labels and groups seem to be there but the actual contact content (name, email address etc) is missing. That contact content info looks like it's still in the database (obviously, I did not change or reinstall roundcube itself) but something to do with the id indexes for the contact content is not matching up with the addressbook entries. Any hint how I fix this or or patch it up manually if I have to? (I posted this in the forum before I found this mailing-list) -- Mark Constable 0419 530 037 https://spiderweb.com.au

4 6

publically verifying roundcube-provided gpg key?
by David Mehler 04 Aug '19

04 Aug '19

Hello, I'm running roundcube and the enigma plugin. I've created a private/public key for my user. I'd like to get that key to a keyserver so that anyone receiving the message can verify it if they want to? Thanks. Dave.

2 1

roundcube calendar
by David Mehler 01 Aug '19

01 Aug '19

Hello, Running a roundcube 1.3 setup, and wanting to get a calendar going. Is this doable? Thanks. Dave.

6 9

Re: [RCU] upgrade to php 7.3
by Andreas Meyer 30 Jul '19

30 Jul '19

Reindl Harald <h.reindl(a)thelounge.net> schrieb am 30.07.19 um 16:03:22 Uhr: > > $ php -v PHP 7.3.7 (cli) (built: Jul 3 2019 11:30:22) ( NTS ) > > Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.7, Copyright > > (c) 1998-2018 Zend Technologies with the ionCube PHP Loader + > > ionCube24 v10.3.7, Copyright (c) 2002-2019, by ionCube Ltd. with > > Zend OPcache v7.3.7, Copyright (c) 1999-2018, by Zend Technologies > > > > and on the server (I installed php 7.3 today) I get a blank screen > > > > # php -v PHP 7.3.7 (cli) (built: Jul 3 2019 11:30:22) ( NTS ) > > Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.7, Copyright > > (c) 1998-2018 Zend Technologies > > > > I also changed <IfModule mod_php5.c> to <IfModule mod_php7.c> in > > the .htaccess of roundcube but that did not change anything. > > well, don't you see the differences? got it now # php -v PHP 7.3.8 (cli) (built: Jul 30 2019 09:26:16) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.8, Copyright (c) 1998-2018 Zend Technologies with the ionCube PHP Loader + ionCube24 v10.3.7, Copyright (c) 2002-2019, by ionCube Ltd. with Zend OPcache v7.3.8, Copyright (c) 1999-2018, by Zend Technologies > > one is using *two* bytecode caches (bad idea) > the other don't run one at all > > they can make subtle differences in good and bad ways > > anyways, this is as so often not a roudcube issue so go and find out > the differences and consider some sort of config management instead of > run randomly different setups spread all over your machines > > upgrading from a random PHP5 version directly to 7.3 is pretty dumb as > you miss all the warnings and deprecation notices between minor > versions and specially 5 to 7 and didn't likely clean up your stuff > over the years > > shopuldn't be a problem with roundcube but you are running 3rd party > stuff given all the issues you had in the past years nobody else had I have it running. Started the installer again and saw there where some dependencies for php7.3 missing not ok. Installed them and didn't need to install roundcube again. Can login, the blank screen (500 server error) is gone. All is well. Thanks! -- Andreas

1 0

Re: [RCU] upgrade to php 7.3
by Andreas Meyer 30 Jul '19

30 Jul '19

Reindl Harald <h.reindl(a)thelounge.net> schrieb am 30.07.19 um 14:16:43 Uhr: > -----BEGIN PGP SIGNED MESSAGE----- > Hash: SHA256 > > > > Am 30.07.19 um 13:49 schrieb Andreas Meyer: > > Today I upgraded from php 5.x to php 7.3 and removed php 5.x > > completly. Now I found I get a blank screen calling roundcube. > > > > I then added error_reporting(E_ALL); ini_set('display_errors', > > 'On'); > > > > and get Notice: Undefined index: env in > > /usr/share/roundcubemail/index.php on line 46 Notice: Undefined > > variable: rcmail_config in > > /usr/share/roundcubemail/program/lib/Roundcube/rcube_config.php on > > line 325 Notice: Undefined offset: 2 in > > /usr/share/roundcubemail/program/lib/Roundcube/rcube_charset.php on > > line 223 > > > > Is there a way to fix this? Should I install roundcube form > > scratch? > > you probably did something else than just replace the PHP binaries > > we are currently on PHP 7.2 because 7.3 is far from production ready > when trivial code like below recently was broken no matter that we > have proper autotests for a 250000 LOC codebase which runs perfectly > with 7.3 and 7.4 HEAD > > so i would not be suprised that you hit a similar or this bug > > /** https://bugs.php.net/bug.php?id=78271 */ > function bug78271($a, $b) > { > if($a==10) > { > $w = "x"; > } > else > { > $w = "y"; > } > if($b) > { > $d1 = "none"; > $d2 = "block"; > } > else > { > $d1 = "block"; > $d2 = "none"; > } > return $d2.$b; > } > if(bug78271(1, 1) !== 'block1') > { > trigger_error('https://bugs.php.net/bug.php?id=78271'); > $exit_code = 1; > } > > why don't you learn to build packages for roundcube and PHP combined > with proper backups of your document roots so that you can upgrade and > downgrade and reinstall everything in a clean way? But wait, on one server with CentOS 7 on which roundcube runs fine I have $ php -v PHP 7.3.7 (cli) (built: Jul 3 2019 11:30:22) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.7, Copyright (c) 1998-2018 Zend Technologies with the ionCube PHP Loader + ionCube24 v10.3.7, Copyright (c) 2002-2019, by ionCube Ltd. with Zend OPcache v7.3.7, Copyright (c) 1999-2018, by Zend Technologies and on the server (I installed php 7.3 today) I get a blank screen # php -v PHP 7.3.7 (cli) (built: Jul 3 2019 11:30:22) ( NTS ) Copyright (c) 1997-2018 The PHP Group Zend Engine v3.3.7, Copyright (c) 1998-2018 Zend Technologies I also changed <IfModule mod_php5.c> to <IfModule mod_php7.c> in the .htaccess of roundcube but that did not change anything. -- Andreas

1 0

upgrade to php 7.3
by Andreas Meyer 30 Jul '19

30 Jul '19

Hello! Today I upgraded from php 5.x to php 7.3 and removed php 5.x completly. Now I found I get a blank screen calling roundcube. I then added error_reporting(E_ALL); ini_set('display_errors', 'On'); and get Notice: Undefined index: env in /usr/share/roundcubemail/index.php on line 46 Notice: Undefined variable: rcmail_config in /usr/share/roundcubemail/program/lib/Roundcube/rcube_config.php on line 325 Notice: Undefined offset: 2 in /usr/share/roundcubemail/program/lib/Roundcube/rcube_charset.php on line 223 Is there a way to fix this? Should I install roundcube form scratch? -- Kind regards Andreas

1 0

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users July 2019